By monitoring a communication executed among a plurality of information processing devices in a computer system including a personal computer (PC), a server device, and the like, an abnormality and the like exemplified below can be found.                An abnormality occurring in a computer system,        An unauthorized deed to a computer system, and        An attack to a computer system.        
A communication is not necessarily a communication executed between a plurality of information processing devices, and may be, for example, a communication executed by processes inside an information processing device.
Hereinafter, in the present application, for convenience of explanation, the above-described abnormality, unauthorized deed, attack, and the like are referred to as “abnormality”.
For example, PTL 1 and PTL 2 disclose a monitoring device for monitoring operating conditions for information processing devices in an information processing system. An administrator monitoring operating conditions in the information processing system monitors an abnormality occurring in the information processing system by referring to a piece of information displayed by the monitoring device.
PTL 1 discloses a failure information display device that displays operating conditions of devices to be monitored (hereinafter, referred to as “target device”). The failure information display device includes an operation monitoring unit and a monitoring screen unit. The operation monitoring unit acquires each of operating conditions of a plurality of target devices, and transmits the acquired information to the monitoring screen unit. The monitoring screen unit receives the information and displays the received information on a display unit. In this case, the monitoring screen unit adjusts the number of pixels of the indicator representing the target device, based on the number of pixels of the display unit and the number of target devices.
PTL 2 discloses a monitoring state display device which displays an index representing a target device in a display region. The monitoring state display device includes usage index number determination means, monitoring target allocation means, and display control means. The usage index number determination means determines the number of indices to be used for displaying a target device having a certain degree of importance, based on a degree of importance of a predetermined target device. Next, the monitoring target allocation means allocates the number of the indices substantially equally to a target device having a certain degree of importance. The display control means displays the target device by the number of allocated indices.